GPG keys for email aliases

Question

Recently the eagerly awaited GPG key verification mark feature made it's debut in Bitbucket Cloud. I've been signing my commits for quite a while now, and I was quite excited, hoping to see the verified sign on all my commits.

However, I'm facing issues trying to add the GPG key of my primary email alias into the list of GPG keys in the bitcucket account settings. My process is as below:

1. Add email alias of the my signing key's email to my accout.

2. Verify the alias

3. Add GPG key via Settings -> Bitbucket Personal settings -> GPG keys -> Add GPG key.

However, I get the following error:

(Email redacted to discourage spammers).

I've tried both with the output of `gpg --armor --export FINGERPRINT` (which contains no comments) as well as the fingerprint as exported by the keyserver I use to publish my public key (keys.openpgp.org; contains the comments as above). In both the cases, I get the same error of no email address in the key, matching my email address.

My questions on this are as follows:

* Is the GPG module not checking against the email aliases of the account?
* Given that `pbcopy` a part of the command to copy the key, are the documentation creators Atlassian support staff or Apple Sales staff?

Regards,

Sam

r4dish · Answer

I'm all for adding this feature. On every service except Bitbucket I can add a GPG key for an email alias, but here it only works with the primary one. I'd like to keep my main address private, commit with an alias, and still be able to sign those commits.

John Hamelink · Answer

Not only is it odd not to support aliases in GPG keys - which is quite a commonly used feature in them (or at least it is in the bubble I inhabit) - there is no clear documentation on this limitation.

The error provided is generic and does not make it obvious that this is the reason why (there are two other reasons given for the 'warning'  invalid signature icon on the commit). A better error message would at least avoid confusion and allow users to quickly understand how to fix the issue (by making a new GPG key just for bitbucket...).

pnelsonsr · Answer

I've been waiting for GPG in Bitbucket for a long time. Of course, I am disappointed that the key does not check against my many dev alias emails.

I looked into adding userIDs-emails to my GPG keys, but that would kind of defeat the purpose of my GPG Key Signing Infrastructure.  So I go back to waiting...